[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF2NPJYVGJ8Y4MBYM6H46H":3,"skill-same:01M6AF2NPJYVGJ8Y4MBYM6H46H":204},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":74,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6AF2NPJYVGJ8Y4MBYM6H46H","implementing-continuous-security-validation-with-bas",null,"Deploys Breach and Attack Simulation (BAS) platforms such as SafeBreach, AttackIQ, Picus, Cymulate, Pentera, or SCYTHE to continuously validate endpoint, network, email-gateway, SIEM, and incident-response effectiveness by safely emulating MITRE ATT&CK techniques. Use when moving beyond point-in-time pentesting to continuous control validation, or standing up automated adversary emulation.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-continuous-security-validation-with-bas\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"implementing continuous security validation with bas","validation","security","ATT&CK","cymulate","picus","attackiq","safebreach","security-validation","bas","breach-attack-simulation","email-gateway","endpoint","vulnerability-management","network","mitre-attack","email","gateway","siem","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-continuous-security-validation-with-bas\ndescription: Deploys Breach and Attack Simulation (BAS) platforms such as SafeBreach,\n  AttackIQ, Picus, Cymulate, Pentera, or SCYTHE to continuously validate endpoint,\n  network, email-gateway, SIEM, and incident-response effectiveness by safely emulating\n  MITRE ATT&CK techniques. Use when moving beyond point-in-time pentesting to continuous\n  control validation, or standing up automated adversary emulation.\ndomain: cybersecurity\nsubdomain: vulnerability-management\ntags:\n- breach-attack-simulation\n- bas\n- security-validation\n- safebreach\n- attackiq\n- picus\n- cymulate\n- mitre-attack\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Application Protocol Command Analysis\n- Identifier Analysis\n- Content Format Conversion\n- Message Analysis\nnist_csf:\n- ID.RA-01\n- ID.RA-02\n- ID.IM-02\n- ID.RA-06\nmitre_attack:\n- T1190\n- T1203\n- T1068\n---\n# Implementing Continuous Security Validation with BAS\n\n## Overview\nBreach and Attack Simulation (BAS) is an automated, continuous approach to validating security control effectiveness by safely executing real-world attack techniques against production security infrastructure. Unlike traditional penetration testing (point-in-time), BAS platforms continuously simulate threats mapped to MITRE ATT&CK, testing endpoint protection, network security, email gateways, SIEM detection, and incident response capabilities. Leading platforms include SafeBreach, AttackIQ, Picus Security (2024 Gartner Customers' Choice), Cymulate, Pentera, and SCYTHE. BAS 2.0 solutions safely emulate real attacker behavior across the entire IT environment without requiring pre-deployed agents on every endpoint.\n\n\n## When to Use\n\n- When deploying or configuring implementing continuous security validation with bas capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n- BAS platform license (SafeBreach, AttackIQ, Picus, Cymulate, or Pentera)\n- Deployed security controls to validate (EDR, NGFW, email gateway, SIEM, WAF)\n- MITRE ATT&CK framework familiarity\n- Network segments accessible by BAS agents\u002Fsimulators\n- Security operations team to act on validation results\n- Change management approval for running simulations in production\n\n## Core Concepts\n\n### BAS vs Traditional Security Testing\n\n| Aspect | BAS | Penetration Testing | Red Team |\n|--------|-----|-------------------|----------|\n| Frequency | Continuous\u002Fscheduled | Annual\u002Fquarterly | Annual |\n| Automation | Fully automated | Manual with tools | Manual |\n| Scope | Full kill chain | Specific targets | Goal-oriented |\n| Safety | Safe simulation, no exploitation | Controlled exploitation | Real exploitation |\n| Coverage | Thousands of techniques | Hundreds of tests | Focused scenarios |\n| Output | Control gap analysis | Vulnerability report | Narrative report |\n| Cost model | Subscription | Per engagement | Per engagement |\n\n### MITRE ATT&CK Coverage Mapping\n\n| Tactic | Example BAS Simulations | Controls Tested |\n|--------|------------------------|-----------------|\n| Initial Access | Phishing payload delivery, exploit public apps | Email gateway, WAF, IPS |\n| Execution | PowerShell, WMI, malicious macros | EDR, application control |\n| Persistence | Registry run keys, scheduled tasks, services | EDR, SIEM detection rules |\n| Privilege Escalation | Token manipulation, UAC bypass | EDR, PAM, SIEM |\n| Defense Evasion | Process injection, obfuscation, timestomping | EDR, behavioral analytics |\n| Credential Access | Mimikatz, Kerberoasting, LSASS dump | EDR, credential guard |\n| Discovery | AD enumeration, network scanning | SIEM, NDR |\n| Lateral Movement | PsExec, WMI, RDP, SMB | NDR, microsegmentation |\n| Collection | Screen capture, keylogging, email collection | DLP, UEBA |\n| Exfiltration | HTTP\u002FDNS exfil, cloud storage upload | DLP, CASB, proxy |\n| Command & Control | C2 beaconing, DNS tunneling, encrypted channels | NGFW, proxy, NDR |\n\n### Security Control Validation Score\n\n```\nControl Effectiveness = (Attacks Prevented + Attacks Detected) \u002F Total Attacks Simulated * 100\n\nExample:\n  Total simulations:  500\n  Prevented (blocked): 350\n  Detected (alerted):  100\n  Missed (no action):   50\n\n  Prevention Rate: 350\u002F500 = 70%\n  Detection Rate:  100\u002F500 = 20%\n  Overall Score:   450\u002F500 = 90%\n  Gap Rate:         50\u002F500 = 10%\n```\n\n## Workflow\n\n### Step 1: Deploy BAS Platform Components\n\n```\nArchitecture:\n  Management Console (Cloud SaaS):\n    - Central orchestration and reporting\n    - Attack scenario library management\n    - MITRE ATT&CK mapping dashboard\n\n  Simulation Agents:\n    - Attacker Agent: Simulates threat actor behavior\n    - Target Agent: Receives simulated attacks\n    - Network Agent: Tests network-level controls\n\n  Deploy agents across zones:\n    - Corporate network (workstations)\n    - DMZ (web servers)\n    - Data center (critical servers)\n    - Cloud environments (AWS\u002FAzure\u002FGCP)\n    - Remote\u002FVPN segment\n```\n\n### Step 2: Configure Attack Scenarios\n\n```yaml\n# Example BAS scenario configuration\nscenario:\n  name: \"APT29 (Cozy Bear) Full Kill Chain\"\n  threat_group: APT29\n  mitre_attack_techniques:\n    - T1566.001  # Spearphishing Attachment\n    - T1059.001  # PowerShell Execution\n    - T1547.001  # Registry Run Key Persistence\n    - T1003.001  # LSASS Memory Credential Dump\n    - T1021.002  # SMB\u002FWindows Admin Shares\n    - T1071.001  # Web Protocol C2\n    - T1048.003  # DNS Exfiltration\n\n  phases:\n    - name: \"Initial Access\"\n      actions:\n        - deliver_phishing_payload:\n            type: office_macro\n            target: email_gateway\n            variants: [docm, xlsm, ppam]\n\n    - name: \"Execution & Persistence\"\n      actions:\n        - execute_powershell:\n            encoded: true\n            amsi_bypass: true\n        - create_scheduled_task:\n            technique: T1053.005\n\n    - name: \"Credential Access\"\n      actions:\n        - dump_lsass:\n            method: [procdump, comsvcs, nanodump]\n\n    - name: \"Lateral Movement\"\n      actions:\n        - psexec_lateral:\n            target: internal_server\n        - wmi_lateral:\n            target: file_server\n\n    - name: \"Exfiltration\"\n      actions:\n        - dns_exfiltration:\n            data_size: 10MB\n            encoding: base64\n```\n\n### Step 3: Map Results to Security Controls\n\n```python\ndef map_bas_results_to_controls(simulation_results):\n    \"\"\"Map BAS results to security control effectiveness.\"\"\"\n    control_scores = {}\n\n    control_mapping = {\n        \"email_gateway\": [\"T1566.001\", \"T1566.002\", \"T1566.003\"],\n        \"edr\": [\"T1059.001\", \"T1003.001\", \"T1055\", \"T1547.001\"],\n        \"ngfw\": [\"T1071.001\", \"T1071.004\", \"T1048\"],\n        \"siem\": [\"T1053.005\", \"T1021.002\", \"T1087\"],\n        \"dlp\": [\"T1048.003\", \"T1567\", \"T1041\"],\n        \"ndr\": [\"T1071\", \"T1021\", \"T1040\"],\n    }\n\n    for control, techniques in control_mapping.items():\n        relevant = [r for r in simulation_results\n                    if r[\"technique_id\"] in techniques]\n        if not relevant:\n            continue\n\n        prevented = sum(1 for r in relevant if r[\"result\"] == \"prevented\")\n        detected = sum(1 for r in relevant if r[\"result\"] == \"detected\")\n        missed = sum(1 for r in relevant if r[\"result\"] == \"missed\")\n        total = len(relevant)\n\n        control_scores[control] = {\n            \"total_tests\": total,\n            \"prevented\": prevented,\n            \"detected\": detected,\n            \"missed\": missed,\n            \"prevention_rate\": round(prevented \u002F total * 100, 1),\n            \"detection_rate\": round(detected \u002F total * 100, 1),\n            \"effectiveness\": round((prevented + detected) \u002F total * 100, 1),\n        }\n\n    return control_scores\n```\n\n### Step 4: Schedule Continuous Validation\n\n```\nValidation Schedule:\n  Daily:\n    - Malware delivery simulation (email gateway test)\n    - C2 communication simulation (firewall\u002Fproxy test)\n    - Known ransomware behavior simulation (EDR test)\n\n  Weekly:\n    - Full kill chain simulation (APT scenario)\n    - Lateral movement simulation (network segmentation test)\n    - Data exfiltration simulation (DLP test)\n\n  Monthly:\n    - Full MITRE ATT&CK coverage assessment\n    - New threat group TTP simulation\n    - Regression testing after security control changes\n\n  On-Demand:\n    - After firewall rule changes\n    - After EDR policy updates\n    - After new threat intelligence (zero-day response)\n```\n\n## Best Practices\n1. Start with known threat group simulations relevant to your industry\n2. Always run simulations in safe mode first before enabling full emulation\n3. Coordinate with SOC team so they can distinguish BAS traffic from real attacks\n4. Use BAS results to prioritize SIEM detection rule development\n5. Track control effectiveness scores over time to demonstrate security posture improvement\n6. Integrate BAS with ticketing systems to auto-generate remediation tickets for gaps\n7. Run validation after every security control change to catch regressions\n8. Map all simulations to MITRE ATT&CK for standardized reporting\n\n## Common Pitfalls\n- Running BAS without informing the SOC, causing unnecessary incident response\n- Testing only prevention and ignoring detection\u002Fresponse validation\n- Not acting on BAS findings, leading to persistent security gaps\n- Deploying BAS agents only in one network zone, missing cross-zone gaps\n- Focusing only on commodity threats instead of APT-relevant scenarios\n- Treating BAS as a replacement for penetration testing rather than a complement\n\n## Related Skills\n- implementing-attack-path-analysis-with-xm-cyber\n- performing-purple-team-exercise\n- implementing-siem-use-cases-for-detection\n- implementing-threat-modeling-with-mitre-attack\n","# Implementing Continuous Security Validation with BAS\n\n## Overview\nBreach and Attack Simulation (BAS) is an automated, continuous approach to validating security control effectiveness by safely executing real-world attack techniques against production security infrastructure. Unlike traditional penetration testing (point-in-time), BAS platforms continuously simulate threats mapped to MITRE ATT&CK, testing endpoint protection, network security, email gateways, SIEM detection, and incident response capabilities. Leading platforms include SafeBreach, AttackIQ, Picus Security (2024 Gartner Customers' Choice), Cymulate, Pentera, and SCYTHE. BAS 2.0 solutions safely emulate real attacker behavior across the entire IT environment without requiring pre-deployed agents on every endpoint.\n\n\n## When to Use\n\n- When deploying or configuring implementing continuous security validation with bas capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n- BAS platform license (SafeBreach, AttackIQ, Picus, Cymulate, or Pentera)\n- Deployed security controls to validate (EDR, NGFW, email gateway, SIEM, WAF)\n- MITRE ATT&CK framework familiarity\n- Network segments accessible by BAS agents\u002Fsimulators\n- Security operations team to act on validation results\n- Change management approval for running simulations in production\n\n## Core Concepts\n\n### BAS vs Traditional Security Testing\n\n| Aspect | BAS | Penetration Testing | Red Team |\n|--------|-----|-------------------|----------|\n| Frequency | Continuous\u002Fscheduled | Annual\u002Fquarterly | Annual |\n| Automation | Fully automated | Manual with tools | Manual |\n| Scope | Full kill chain | Specific targets | Goal-oriented |\n| Safety | Safe simulation, no exploitation | Controlled exploitation | Real exploitation |\n| Coverage | Thousands of techniques | Hundreds of tests | Focused scenarios |\n| Output | Control gap analysis | Vulnerability report | Narrative report |\n| Cost model | Subscription | Per engagement | Per engagement |\n\n### MITRE ATT&CK Coverage Mapping\n\n| Tactic | Example BAS Simulations | Controls Tested |\n|--------|------------------------|-----------------|\n| Initial Access | Phishing payload delivery, exploit public apps | Email gateway, WAF, IPS |\n| Execution | PowerShell, WMI, malicious macros | EDR, application control |\n| Persistence | Registry run keys, scheduled tasks, services | EDR, SIEM detection rules |\n| Privilege Escalation | Token manipulation, UAC bypass | EDR, PAM, SIEM |\n| Defense Evasion | Process injection, obfuscation, timestomping | EDR, behavioral analytics |\n| Credential Access | Mimikatz, Kerberoasting, LSASS dump | EDR, credential guard |\n| Discovery | AD enumeration, network scanning | SIEM, NDR |\n| Lateral Movement | PsExec, WMI, RDP, SMB | NDR, microsegmentation |\n| Collection | Screen capture, keylogging, email collection | DLP, UEBA |\n| Exfiltration | HTTP\u002FDNS exfil, cloud storage upload | DLP, CASB, proxy |\n| Command & Control | C2 beaconing, DNS tunneling, encrypted channels | NGFW, proxy, NDR |\n\n### Security Control Validation Score\n\n```\nControl Effectiveness = (Attacks Prevented + Attacks Detected) \u002F Total Attacks Simulated * 100\n\nExample:\n  Total simulations:  500\n  Prevented (blocked): 350\n  Detected (alerted):  100\n  Missed (no action):   50\n\n  Prevention Rate: 350\u002F500 = 70%\n  Detection Rate:  100\u002F500 = 20%\n  Overall Score:   450\u002F500 = 90%\n  Gap Rate:         50\u002F500 = 10%\n```\n\n## Workflow\n\n### Step 1: Deploy BAS Platform Components\n\n```\nArchitecture:\n  Management Console (Cloud SaaS):\n    - Central orchestration and reporting\n    - Attack scenario library management\n    - MITRE ATT&CK mapping dashboard\n\n  Simulation Agents:\n    - Attacker Agent: Simulates threat actor behavior\n    - Target Agent: Receives simulated attacks\n    - Network Agent: Tests network-level controls\n\n  Deploy agents across zones:\n    - Corporate network (workstations)\n    - DMZ (web servers)\n    - Data center (critical servers)\n    - Cloud environments (AWS\u002FAzure\u002FGCP)\n    - Remote\u002FVPN segment\n```\n\n### Step 2: Configure Attack Scenarios\n\n```yaml\n# Example BAS scenario configuration\nscenario:\n  name: \"APT29 (Cozy Bear) Full Kill Chain\"\n  threat_group: APT29\n  mitre_attack_techniques:\n    - T1566.001  # Spearphishing Attachment\n    - T1059.001  # PowerShell Execution\n    - T1547.001  # Registry Run Key Persistence\n    - T1003.001  # LSASS Memory Credential Dump\n    - T1021.002  # SMB\u002FWindows Admin Shares\n    - T1071.001  # Web Protocol C2\n    - T1048.003  # DNS Exfiltration\n\n  phases:\n    - name: \"Initial Access\"\n      actions:\n        - deliver_phishing_payload:\n            type: office_macro\n            target: email_gateway\n            variants: [docm, xlsm, ppam]\n\n    - name: \"Execution & Persistence\"\n      actions:\n        - execute_powershell:\n            encoded: true\n            amsi_bypass: true\n        - create_scheduled_task:\n            technique: T1053.005\n\n    - name: \"Credential Access\"\n      actions:\n        - dump_lsass:\n            method: [procdump, comsvcs, nanodump]\n\n    - name: \"Lateral Movement\"\n      actions:\n        - psexec_lateral:\n            target: internal_server\n        - wmi_lateral:\n            target: file_server\n\n    - name: \"Exfiltration\"\n      actions:\n        - dns_exfiltration:\n            data_size: 10MB\n            encoding: base64\n```\n\n### Step 3: Map Results to Security Controls\n\n```python\ndef map_bas_results_to_controls(simulation_results):\n    \"\"\"Map BAS results to security control effectiveness.\"\"\"\n    control_scores = {}\n\n    control_mapping = {\n        \"email_gateway\": [\"T1566.001\", \"T1566.002\", \"T1566.003\"],\n        \"edr\": [\"T1059.001\", \"T1003.001\", \"T1055\", \"T1547.001\"],\n        \"ngfw\": [\"T1071.001\", \"T1071.004\", \"T1048\"],\n        \"siem\": [\"T1053.005\", \"T1021.002\", \"T1087\"],\n        \"dlp\": [\"T1048.003\", \"T1567\", \"T1041\"],\n        \"ndr\": [\"T1071\", \"T1021\", \"T1040\"],\n    }\n\n    for control, techniques in control_mapping.items():\n        relevant = [r for r in simulation_results\n                    if r[\"technique_id\"] in techniques]\n        if not relevant:\n            continue\n\n        prevented = sum(1 for r in relevant if r[\"result\"] == \"prevented\")\n        detected = sum(1 for r in relevant if r[\"result\"] == \"detected\")\n        missed = sum(1 for r in relevant if r[\"result\"] == \"missed\")\n        total = len(relevant)\n\n        control_scores[control] = {\n            \"total_tests\": total,\n            \"prevented\": prevented,\n            \"detected\": detected,\n            \"missed\": missed,\n            \"prevention_rate\": round(prevented \u002F total * 100, 1),\n            \"detection_rate\": round(detected \u002F total * 100, 1),\n            \"effectiveness\": round((prevented + detected) \u002F total * 100, 1),\n        }\n\n    return control_scores\n```\n\n### Step 4: Schedule Continuous Validation\n\n```\nValidation Schedule:\n  Daily:\n    - Malware delivery simulation (email gateway test)\n    - C2 communication simulation (firewall\u002Fproxy test)\n    - Known ransomware behavior simulation (EDR test)\n\n  Weekly:\n    - Full kill chain simulation (APT scenario)\n    - Lateral movement simulation (network segmentation test)\n    - Data exfiltration simulation (DLP test)\n\n  Monthly:\n    - Full MITRE ATT&CK coverage assessment\n    - New threat group TTP simulation\n    - Regression testing after security control changes\n\n  On-Demand:\n    - After firewall rule changes\n    - After EDR policy updates\n    - After new threat intelligence (zero-day response)\n```\n\n## Best Practices\n1. Start with known threat group simulations relevant to your industry\n2. Always run simulations in safe mode first before enabling full emulation\n3. Coordinate with SOC team so they can distinguish BAS traffic from real attacks\n4. Use BAS results to prioritize SIEM detection rule development\n5. Track control effectiveness scores over time to demonstrate security posture improvement\n6. Integrate BAS with ticketing systems to auto-generate remediation tickets for gaps\n7. Run validation after every security control change to catch regressions\n8. Map all simulations to MITRE ATT&CK for standardized reporting\n\n## Common Pitfalls\n- Running BAS without informing the SOC, causing unnecessary incident response\n- Testing only prevention and ignoring detection\u002Fresponse validation\n- Not acting on BAS findings, leading to persistent security gaps\n- Deploying BAS agents only in one network zone, missing cross-zone gaps\n- Focusing only on commodity threats instead of APT-relevant scenarios\n- Treating BAS as a replacement for penetration testing rather than a complement\n\n## Related Skills\n- implementing-attack-path-analysis-with-xm-cyber\n- performing-purple-team-exercise\n- implementing-siem-use-cases-for-detection\n- implementing-threat-modeling-with-mitre-attack\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"nist_csf":52,"subdomain":37,"description":7,"mitre_attack":57,"d3fend_techniques":61},[34,33,32,31,30,29,28,39],"mahipal","1.0",[53,54,55,56],"ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06",[58,59,60],"T1190","T1203","T1068",[62,63,64,65,66],"File Metadata Consistency Validation","Application Protocol Command Analysis","Identifier Analysis","Content Format Conversion","Message Analysis","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-continuous-security-validation-with-bas",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-continuous-security-validation-with-bas",{"tool":83,"command":84},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-continuous-security-validation-with-bas",{"tool":86,"command":87},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-continuous-security-validation-with-bas","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-continuous-security-validation-with-bas\u002FSKILL.md",true,[91,97,102,108,112,116,122,126,130,136,140,144,148,152,156,160,164,168,172,176,180,184,188,192,196,200],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"assets\u002Ftemplate.md","ASSET","资产文件",864,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-continuous-security-validation-with-bas\u002Fassets\u002Ftemplate.md",{"path":98,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-continuous-security-validation-with-bas\u002FLICENSE",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"references\u002Fapi-reference.md","REFERENCE","参考文档",1599,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-continuous-security-validation-with-bas\u002Freferences\u002Fapi-reference.md",{"path":109,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":110,"sourceHtmlUrl":111},"references\u002Fstandards.md",1033,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-continuous-security-validation-with-bas\u002Freferences\u002Fstandards.md",{"path":113,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":114,"sourceHtmlUrl":115},"references\u002Fworkflows.md",1763,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-continuous-security-validation-with-bas\u002Freferences\u002Fworkflows.md",{"path":117,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":120,"sourceHtmlUrl":121},"scripts\u002Fagent.py","SCRIPT","脚本",5940,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-continuous-security-validation-with-bas\u002Fscripts\u002Fagent.py",{"path":123,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":124,"sourceHtmlUrl":125},"scripts\u002Fprocess.py",4743,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-continuous-security-validation-with-bas\u002Fscripts\u002Fprocess.py",{"path":127,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":128,"sourceHtmlUrl":129},"templates\u002Fdocs\u002Fmeasurements.md",450,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Fdocs\u002Fmeasurements.md",{"path":131,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":134,"sourceHtmlUrl":135},"templates\u002Fdot_gitignore","OTHER","其他",293,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Fdot_gitignore",{"path":137,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":138,"sourceHtmlUrl":139},"templates\u002Fparams.scad",351,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Fparams.scad",{"path":141,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":142,"sourceHtmlUrl":143},"templates\u002Fparams\u002Fcommon.scad",748,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Fparams\u002Fcommon.scad",{"path":145,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":146,"sourceHtmlUrl":147},"templates\u002Fpyproject.toml",468,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Fpyproject.toml",{"path":149,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":150,"sourceHtmlUrl":151},"templates\u002Fscripts\u002Fbambu.py",11735,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Fscripts\u002Fbambu.py",{"path":153,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":154,"sourceHtmlUrl":155},"templates\u002Fscripts\u002Fcompare.py",1919,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Fscripts\u002Fcompare.py",{"path":157,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":158,"sourceHtmlUrl":159},"templates\u002Fscripts\u002Fexport.py",7530,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Fscripts\u002Fexport.py",{"path":161,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":162,"sourceHtmlUrl":163},"templates\u002Fscripts\u002Fprint_parts.py",5387,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Fscripts\u002Fprint_parts.py",{"path":165,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":166,"sourceHtmlUrl":167},"templates\u002Fscripts\u002Fprint_status.toml",535,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Fscripts\u002Fprint_status.toml",{"path":169,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":170,"sourceHtmlUrl":171},"templates\u002Fscripts\u002Frender.py",4893,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Fscripts\u002Frender.py",{"path":173,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":174,"sourceHtmlUrl":175},"templates\u002Fscripts\u002Fslice.py",13549,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Fscripts\u002Fslice.py",{"path":177,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":178,"sourceHtmlUrl":179},"templates\u002Fscripts\u002Fsupport_map.py",2789,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Fscripts\u002Fsupport_map.py",{"path":181,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":182,"sourceHtmlUrl":183},"templates\u002Fscripts\u002Ftest.sh",384,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Fscripts\u002Ftest.sh",{"path":185,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":186,"sourceHtmlUrl":187},"templates\u002Ftest\u002Fscad.py",3410,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Ftest\u002Fscad.py",{"path":189,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":190,"sourceHtmlUrl":191},"templates\u002Ftest\u002Ftest_layout.py",2485,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Ftest\u002Ftest_layout.py",{"path":193,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":194,"sourceHtmlUrl":195},"templates\u002Ftest\u002Ftest_measurements.py",1010,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Ftest\u002Ftest_measurements.py",{"path":197,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":198,"sourceHtmlUrl":199},"templates\u002Ftest\u002Ftest_print.py",10153,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Ftest\u002Ftest_print.py",{"path":201,"resourceType":118,"resourceTypeDesc":119,"sizeBytes":202,"sourceHtmlUrl":203},"templates\u002Ftest\u002Ftest_slice.py",10473,"https:\u002F\u002Fgithub.com\u002FTownk\u002Fdotfiles\u002Fblob\u002Fmaster\u002Fhome\u002Fdot_config\u002Fagent-skills\u002F3d-print-project\u002Ftemplates\u002Ftest\u002Ftest_slice.py",[205,231,255,282,308,334],{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":212,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[211],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[213,214,215,216,26,43,217,218,219,220,221,222,223,224,225,226,227,228,229,230],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":232,"name":233,"nameZh":6,"description":234,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":235,"categories":236,"keywords":238,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[237],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[239,227,240,241,26,242,43,219,243,244,245,246,247,248,249,250,251,252,253,254],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":256,"name":257,"nameZh":6,"description":258,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":259,"categories":260,"keywords":265,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[261,264],{"categoryNo":262,"categoryName":263,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[249,266,267,268,269,43,270,25,243,271,272,273,274,275,276,277,278,279,280,281],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":283,"name":284,"nameZh":6,"description":285,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":286,"categories":287,"keywords":289,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[288],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[290,291,292,43,293,294,295,296,297,298,299,300,301,302,303,304,246,305,306,307],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":309,"name":310,"nameZh":6,"description":311,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":312,"categories":313,"keywords":315,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[314],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[316,317,318,43,319,320,321,37,322,323,324,325,326,327,328,329,330,331,332,333],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":335,"name":336,"nameZh":6,"description":337,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":338,"categories":339,"keywords":341,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[340],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[26,342,43,42,343,344,345,346,347,348,349,277,350,278,351,352,353,354,355,356],"triaging security incident","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]